Timeline for Why doesn't the Stack Overflow team fix the Firesheep style cookie theft?
Current License: CC BY-SA 3.0
39 events
when toggle format | what | by | license | comment | |
---|---|---|---|---|---|
Apr 9, 2017 at 19:56 | comment | added | Rook | @Zypher independent.co.uk/life-style/gadgets-and-tech/news/… | |
Jul 18, 2016 at 0:56 | comment | added | user2284570 |
@Zypher :just not a priority right now Will it become a priority the day the attorney of a user of foreign country will ask you private logs because he got his account hijacked and used for posting illegal materials ?
|
|
Mar 2, 2016 at 2:04 | comment | added | Rook | It is 2016 and I can still hijack StackOverflow accounts :'( | |
Sep 30, 2013 at 3:08 | comment | added | Joe R. | Since you're concern is more with performance and not the cost of providing a valid certificate and secure connection for all users, the solution would be to host your websites on akamai servers. I am skeptical about StackExchange sites lack of security, since you have both white and black hat users on it! | |
Apr 14, 2013 at 21:14 | comment | added | Rook | This post makes SO look bad, perhaps it needs an update. | |
Feb 18, 2013 at 18:11 | comment | added | Rook | If 2% of your effort is not worth spending on security, then you deserve to be hacked. This is disgusting. | |
Nov 9, 2012 at 22:45 | comment | added | Brendan Long | It's worth noting, from Google again: "On our production frontend machines, SSL/TLS accounts for less than 1% of the CPU load, less than 10KB of memory per connection and less than 2% of network overhead." So, the increased network usage was also insignificant. | |
Jan 12, 2012 at 20:45 | comment | added | Arjan | For future reference: for real life CPU and memory utilization see the graphs in Global Login Reset In The Near Future. | |
Dec 28, 2011 at 14:59 | history | edited | ale | CC BY-SA 3.0 |
dollar signs were in the wrong place
|
Jun 22, 2011 at 20:50 | comment | added | Tamara Wijsman | @Zypher: The link on your profile is broke... (blog.serverfault.com/post/1191927346/…) | |
Apr 26, 2011 at 14:42 | comment | added | Zypher Mod | @intgr it's not an obstacle, just not a priority right now. @Arjan not off the top of my head. | |
Apr 26, 2011 at 12:06 | comment | added | Arjan | @Zypher, it's clear that it's not only about the number of visitors, but also about load balancing et al. Still, just curious: any idea what percentage of the 10MM Monthly uniques is requested by logged-in users? | |
Mar 30, 2011 at 12:17 | comment | added | intgr | It's not as simple as buying a $20 cert, sure. But in order to run a site like SO, you've no doubt had to solve a lot harder problems. Why is HTTPS proving to be such an obstacle for you? | |
Mar 6, 2011 at 0:03 | comment | added | Rook | I still wish that so had a certificate so at least i would be safe. It would also be helpful for the admins. | |
Feb 9, 2011 at 21:49 | comment | added | Rook | @Jeff Atwood SSL is cheaper than getting hacked. | |
Feb 6, 2011 at 11:27 | comment | added | Jeff Atwood | @rook you might be interested in devcentral.f5.com/weblogs/macvittie/archive/2011/01/31/… | |
Jan 8, 2011 at 18:15 | comment | added | Rook | BTW, buying a $20 certificate completely and totally fixes my problem because i can use HTTPSEverywhere and not get hacked. Everyone else is still screwed. | |
Jan 7, 2011 at 21:21 | history | edited | ZypherMod | CC BY-SA 2.5 |
added 69 characters in body
|
Jan 7, 2011 at 20:26 | comment | added | abel | @Zypher start with optional self signed certificates? | |
Jan 7, 2011 at 18:32 | comment | added | Donal Fellows | You can run a high-volume site with a cheap certificate. What you can't do is run multiple domains with it; it's the multi-domain and wildcard certificates that cost significant cash, and you'd need them to handle the Trilogy and the SE sites, respectively. (You're right that the cost of all those SSL sessions is more important though.) | |
Jan 4, 2011 at 21:31 | comment | added | jcolebrand | @Zypher I think it's fine without the HTTPS myself. I'm not using my computer on unsecured networks doing things that need securing anyways. | |
Jan 4, 2011 at 13:23 | comment | added | Zypher Mod | @Zoredache : Mostly because it hasn't been something that has been set as a priority by Jeff/Joel and I've got a lot on my plate right now. Also @drachenstern we could do it at the load balancer for one site, however risking a site that is trying to grow to get data doesn't sit well with me. If it becomes a priority or if I get free time to work on $project i'll setup a lab environment and get more solid numbers that way | |
Jan 4, 2011 at 4:11 | comment | added | jcolebrand | @Zoredache ~ The problem is that a) they don't put one server per site, it's called STACKexchange for a reason. b) who cares about a low volume site? I want to know about the trilogy. | |
Jan 4, 2011 at 4:10 | comment | added | jcolebrand | Can I point out to the likes of @alexandarpas that Google doesn't really have a question of "can we divert a few more servers to this cluster" because they are only one of the largest producers of computer hardware on the planet. They can always come up with a few more servers for internal use. SOIS, on the other hand, is not one of the worlds largest computer manufacturers and so they do need time to design, plan, and acquire new computers to augment the existing network. Just some food for thought. | |
Jan 3, 2011 at 22:16 | comment | added | Zoredache | So what is preventing you from picking one of the newer low volume sites, perhaps security.stackexchange, and collecting some performance data? You seem to think it is a huge problem, but if you could actually provide proof, you would be a lot more convincing. | |
Dec 12, 2010 at 6:40 | comment | added | alexanderpas | @Zypher, true, but isn't that cost associated with every change in hardware/software, and/or new features. Adding SSL should be handled just like adding any other feature -- also: The belief that switching to using pure SSL/TLS is any burden was obsoleted years ago with the addition of SSL/TLS Session Resume. Session Resume allows a particular client and server to perform the high-overhead public key negotiation just once quoted from the link in @BlueRaja post. meaning the more a user uses the site, the less an impact the negotiation has on the server. | |
Dec 10, 2010 at 2:17 | comment | added | Zypher Mod | @alexanderpas please re-read my post, the majority of it had very little to do with CPU overhead most of it was about following the 7P's. I'm not sure how much more i can emphasize you do not just throw certificates onto a very busy server and say "cool, all done let me rake in the money." The cost of the cert is definitely not the issue here. | |
Dec 10, 2010 at 2:15 | history | edited | ZypherMod | CC BY-SA 2.5 |
added 357 characters in body
|
Dec 10, 2010 at 1:38 | comment | added | alexanderpas | @Jeff indeed, just ask google when they implemented https for everyone in gmail... without adding new hardware etc. the total performance degradation was a whopping 1%! | |
Nov 17, 2010 at 16:55 | history | edited | This_is_NOT_a_forum | CC BY-SA 2.5 |
added 32 characters in body
|
Nov 5, 2010 at 14:25 | comment | added | BlueRaja | oh hai there. I'll just leave this here: steve.grc.com/2010/10/28/why-firesheeps-time-has-come | |
Nov 3, 2010 at 21:18 | comment | added | Zypher | @nevan except the SSL connection is negotiated before anything else, so we would have to still have to design for a large amount of SSL traffic, and then redirect those under 10k | |
Nov 3, 2010 at 21:07 | comment | added | nevan king | I wonder if it would be an option to enable HTTPS for users with a reputation over 1000? That would solve the large number of users problem and be an incentive to use the site. It's like turning off ads for users with a higher rep. | |
Nov 2, 2010 at 11:45 | comment | added | Zypher | @Kop no I understood you, but you have to realize that engineering for the possibility of using SSL is the same as for forcing SSL, You need to solve the latter problem in case you find a large number of your users opting in to using SSL. | |
Nov 2, 2010 at 11:16 | comment | added | Andreas Bonini | Maybe you misunderstood my comment, but I simply meant the possibility of using https, not it being automatic on every page for any user. | |
Nov 2, 2010 at 0:18 | comment | added | Jeff Atwood | to play devil's advocate: SSL isn't that expensive any more. | |
Nov 1, 2010 at 23:37 | vote | accept | Rook | ||
Nov 7, 2010 at 22:13 | |||||
Nov 1, 2010 at 23:28 | comment | added | jjnguy | It should be noted that you are one of SE's sysadmins. blog.stackoverflow.com/2010/09/… | |
Nov 1, 2010 at 23:20 | history | answered | Zypher | CC BY-SA 2.5 |